Enable Guest+ users to execute custom agents in the WebUI

What does this MR do and why?

Part of Allow Guest+ to execute custom agents in foregr... (#582507 - closed)

Updates the read_ai_catalog_item permission in ItemPolicy from Developer+ to Guest+ access level, enabling foreground execution of custom agents in the WebUI for Guest+ users.

Currently custom agents in the WebUI require Developer+ access. This change is a prerequisite for creating a unified "foreground execution" role-based permission that will control foreground execution of both agents and flows. Before introducing that permission, we need to lower the existing requirements for custom agent execution in the WebUI to Guest+ access.

Depends on Enable Guest+ users to execute custom agents in... (!214732 - merged)

To enable Guest+ roles to use custom agents for foreground execution we need to implement:

Environment
foreground execution from an IDE Enable Guest+ users to execute custom agents in... (!214732 - merged)
foreground execution from the WebUI This MR

References

Screenshots or screen recordings

role in Project Before After
Guest with Duo seat assignment Screenshot 2025-12-03 at 4.21.59 PM.png Screenshot 2025-12-03 at 4.10.41 PM.png
Planner Screenshot 2025-12-03 at 4.20.23 PM.png Screenshot 2025-12-03 at 4.14.30 PM.png

How to set up and validate locally

  1. Check out this branch
  2. Start GDK
  3. Navigate to a project with DAP enabled, such as http://gdk.test:3000/gitlab-duo/test
  4. Open chat WebUI in Agentic mode
    1. Verify for a Guest with a Duo seat assignment
      1. Custom Agents are additionally listed in the Agents dropdown
      2. the Guest can use a Custom Agent with Agentic chat
  5. Verify for any other roles (Planner+)
    1. Custom Agents are additionally listed in the Agents dropdown
    2. the Guest can use a Custom Agent with Agentic chat

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Katherine Richards

Merge request reports

Loading